CVE-2025-58315 is a medium severity permission control vulnerability in the Wi-Fi module of Huawei's HarmonyOS versions 5.0.1, 5.1.0, and 6.0.0. The flaw relates to improper permissions and access controls (CWE-264), potentially allowing unauthorized local attackers to disrupt service availability. Exploitation requires local access and user interaction but does not impact confidentiality or integrity directly. No known exploits are currently reported in the wild.
CVE-2025-58314 is an out-of-bounds read vulnerability (CWE-125) in Huawei HarmonyOS affecting multiple versions from 2.0.0 to 6.0.0. It arises from improper memory access in a component driver module, potentially leading to unauthorized disclosure of sensitive information and partial disruption of system availability. The vulnerability requires local access with low privileges and no user interaction, with an attack vector classified as local. The CVSS 3.1 base score is 6.6 (medium severity), reflecting high confidentiality impact, low integrity impact, and low availability impact.
CVE-2025-58312 is a medium severity permission control vulnerability in Huawei HarmonyOS's App Lock module affecting versions 5.0.1, 5.1.0, and 6.0.0. The flaw relates to improper permissions, potentially impacting system availability if exploited. Exploitation requires local access with high attack complexity and no user interaction, and no privileges or authentication are needed. Although the CVSS vector indicates a confidentiality impact, the description emphasizes availability impact, suggesting some ambiguity in impact assessment.
CVE-2025-58310 is a high-severity permission control vulnerability in Huawei's HarmonyOS distributed component caused by a type confusion flaw (CWE-843). It affects versions 5.0.1, 5.1.0, and 6.0.0. Exploitation requires local access but no privileges or user interaction, potentially allowing attackers to compromise service confidentiality, degrade integrity, and disrupt availability. No known exploits are currently in the wild.
CVE-2025-58309 is a permission control vulnerability in Huawei's HarmonyOS startup recovery module. Exploiting this flaw can lead to a loss of system availability and partial confidentiality compromise without requiring user interaction or privileges. The vulnerability affects multiple versions of HarmonyOS (5.0.1, 5.1.0, and 6.0.0) and has a CVSS score of 6.8, indicating medium severity.
CVE-2025-58307 is a use-after-free (UAF) vulnerability in the screen recording framework module of Huawei HarmonyOS versions 5.0.1, 5.1.0, and 6.0.0. Exploitation requires local access with high privileges and no user interaction, potentially impacting confidentiality, integrity, and availability. The vulnerability could lead to system instability or denial of service, affecting device availability. There are no known exploits in the wild, and no patches have been published yet.
CVE-2025-58316 is a high-severity denial-of-service (DoS) vulnerability in Huawei HarmonyOS affecting versions 5.0.1, 5.1.0, and 6.0.0. It stems from a race condition (CWE-362) in the video-related system service module due to improper synchronization of shared resources. Exploitation requires local access and no user interaction or privileges, potentially causing system unavailability. No known exploits are currently in the wild.
CVE-2025-58303 is a high-severity race condition vulnerability in Huawei HarmonyOS affecting the screen recording framework. It involves a use-after-free (UAF) flaw caused by improper synchronization during concurrent execution of shared resources. Exploitation can lead to significant impacts on system confidentiality, integrity, and availability without requiring user interaction or privileges. The vulnerability affects multiple HarmonyOS versions (5.0.1, 5.1.0, and 6.0.0).
CVE-2025-64315 is a medium-severity configuration defect vulnerability in Huawei HarmonyOS version 5.1.0's file management module. It involves improper permissions, privileges, and access controls (CWE-264) that could allow an attacker with local access and user interaction to compromise app data confidentiality and integrity. The vulnerability does not require privileges and has low complexity to exploit but requires user interaction. There are no known exploits in the wild yet. The impact is limited to confidentiality and integrity without affecting availability. European organizations using HarmonyOS devices could be affected, especially where Huawei devices have significant market penetration. Mitigation involves applying patches once available, restricting local access, and monitoring file management operations closely. Countries with higher Huawei device usage and strategic interest in Huawei technology, such as Germany, France, Italy, Spain, and the UK, are more likely to be impacted.
CVE-2025-64314 is a critical permission control vulnerability in Huawei's HarmonyOS version 5.1.0, caused by a type confusion flaw (CWE-843) in the memory management module. Exploiting this vulnerability requires local access but no privileges or user interaction, allowing an attacker to gain full confidentiality, integrity, and availability impact on the system. The vulnerability enables unauthorized access to sensitive resources due to improper type handling, potentially leading to privilege escalation or arbitrary code execution. Although no known exploits are currently in the wild, the high CVSS score (9.3) indicates severe risk. European organizations using Huawei devices running HarmonyOS 5.1.0, especially in telecommunications and critical infrastructure sectors, are at risk.
